Add policy client and protocol plumbing

[dsa0x]

This is part of a stacked series to upstream the policy work in smaller, reviewable pieces:

• [Add policy client and protocol plumbing #38514] (this)
• [Add policy result types and diagnostic metadata plumbing #38515]
• [Wire policy evaluation into Terraform core runtime #38516]
• [Add CLI and backend policy wiring for plan apply and query #38518]
• [Add init-time policy evaluation #38519]

This PR introduces the policy package and the basic protocol/client plumbing that the rest of the stack builds on.
The goal here is to land the policy-specific infrastructure first so the later PRs can focus on runtime behavior.

Included here

• policy client setup and implementation
• RPC protocol types,
• policy diagnostics/types
• callback service plumbing
• generated protobufs
• protobuf compile tool updates

Target Release

1.16.x

Rollback Plan

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

CHANGELOG entry

• This change is user-facing and I added a changelog entry.
• This change is not user-facing.